VYPR
← All advisories
Unrated severityNVD Advisory· Published May 19, 2022· Updated Nov 3, 2025

Out-of-bounds Write in vim/vim

CVE-2022-1785

Description

An out-of-bounds write in vim's substitute command before 8.2.4977 could allow a crafted expression to trigger memory corruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds write in vim's substitute command before 8.2.4977 could allow a crafted expression to trigger memory corruption.

Vulnerability

An out-of-bounds write vulnerability exists in the ex_substitute() function in Vim (src/ex_docmd.c) prior to version 8.2.4977 [1]. The issue occurs when a substitute expression (e.g., :s/foo/\=execute('...')/) changes text or switches windows during the substitution, causing memory corruption [1][4]. The patch introduces a textwinlock variable to prevent such changes during substitute expression evaluation [1].

Exploitation

An attacker needs to convince a victim to open a specially crafted file and run the substitute command with an expression that modifies the buffer or switches windows while the substitution is being computed [1][4]. The vulnerability can be triggered through a user-assisted scenario, such as opening a malicious file in Vim and executing a substitute command with a crafted expression \=execute('...') that recursively alters text or windows [1].

Impact

Successful exploitation results in an out-of-bounds write, which can corrupt memory and potentially lead to arbitrary code execution or denial of service [1][4]. The attacker gains the ability to execute code with the privileges of the user running Vim [1][4].

Mitigation

The fix is included in Vim version 8.2.4977 and later [1]. Users should upgrade to at least that version. Gentoo Linux provides updated packages (>=app-editors/vim-9.0.0060 and later >=app-editors/vim-9.0.1157) [2][3]. No workaround is available [2][3].

References
  1. patch 8.2.4977: memory access error when substitute expression change… · vim/vim@e2bd860
  2. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security
  3. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security
  4. The world’s first bug bounty platform for AI/ML

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

43

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.